Skip to main content
Safety · security

Is PumpStriker safe? Security for your keys, trades and this site

PumpStriker is self-hosted: your wallet keys are stored encrypted only on your own machine, and every trade is signed there. A key passes through your private Telegram chat once, when you import or generate a wallet. The bot answers only you and checks every buy and sell before signing. You secure your machine, Telegram account and bot token.

By Mezyan D, Bathyr Devs Last reviewed

Official channelsReport a problem

What are the key facts about PumpStriker security?

Key factsas of November 2026
CustodySelf-hosted: wallet keys are stored encrypted only on your machine, and every trade is signed thereLive
Key encryptionAES-256-GCM under a scrypt-derived key, with a fresh salt per wallet; set your own WALLET_ENC_KEYLive
How a key gets inImport or Generate New, once, in your private Telegram chat; a pasted key is deleted at onceLive
Who can command the botOnly you, in a private chat; groups, edits, channel posts and inline queries are ignoredLive
Engine-to-bot linkListens only on 127.0.0.1 and needs a shared secret of at least 32 charactersLive
Before signingEvery buy and sell is checked against your request and simulatedLive
Source codeThe bot's full source code comes with your download (MIT licence)
Report a problembathyrdev@pumpstriker.fun
Live
In the current build and on by default, or on when you turn it on.

How does PumpStriker store your wallet keys?

Your wallet keys are stored encrypted only on your machine, and every trade is signed there. The bot never sends a key to Bathyr Devs, and Bathyr Devs never holds or moves your funds.

Keys are encrypted at rest with AES-256-GCM under a scrypt-derived key, with a fresh salt per wallet. That key comes from your WALLET_ENC_KEY setting. If you do not set one, the keys are encrypted under your Telegram bot token, so set your own random WALLET_ENC_KEY of 32 or more characters.

How does a key get into the bot?

Through your private Telegram chat with your own bot, once. Use a dedicated trading wallet that holds only what you trade with.

Wallets in the bot
ProtectionWhat it does
Import walletPaste a base58 private key into your private chat with the bot. The bot deletes the message at once and shows only the public address; the key has still passed through Telegram once.
Generate NewCreates a new Solana wallet in one tap and shows its private key once in the chat, with a back-up warning. Save the key offline, then delete that message for both sides.
Up to 3 walletsChoose a default, rename or remove a wallet, and see its SOL and wSOL balances.
Pasted-secret guardA private key or seed phrase pasted anywhere in the chat is deleted at once.

Which protections are built in?

Built-in protections
ProtectionWhat it does
Owner-only private chatThe bot answers only its owner, only in a private chat. Groups, edits, channel posts and inline queries are ignored, and forged buttons are refused.
Local Engine-to-bot linkListens only on 127.0.0.1 and needs a shared secret of at least 32 characters, compared in constant time. Browser requests and non-loopback hosts are refused.
Local dashboardServed by the Engine on your own machine. On its Wallet page the bot prepares unsigned transactions, and only your own browser wallet signs.
Pre-sign verificationEvery buy and sell is checked against what you asked for and simulated before signing. Send SOL, wSOL wrap and unwrap and rent-reclaim transactions are sent without this check.
On-chain fillsFills are read from the chain, not from the quote, and the bot tells you plainly if a buy did not land.
Trade guardsSlippage (0.1 to 50%) and priority fees are bounded, and addresses and amounts are validated.
Redaction and input checksLogs and errors never show keys, and every typed number is range-checked.

What are the limits?

  • Importing a key passes it through Telegram once, and Generate New shows a new key in the chat once.
  • If WALLET_ENC_KEY is not set, keys are encrypted under the bot token.
  • Some settings shown in the bot's menus have no effect in this build. Rely only on the features this site describes.
  • On-chain transactions are final. We cannot reverse them or recover keys.
  • Software cannot make memecoin trading safe.

What do you need to secure yourself?

PumpStriker runs on your machine, so its security depends on that machine and your accounts. Work through this list:

  1. Use a separate trading wallet that holds only the amounts you trade.
  2. Keep the operating system of the machine that runs PumpStriker up to date.
  3. Never expose ports 1002 or 3748 outside your machine.
  4. Turn on Telegram two-step verification and a passcode, and review your active sessions.
  5. Treat TG_BOT_TOKEN like a private key.
  6. After Generate New, store the key offline and delete that message for both sides.
  7. Encrypt backups of the data folder.
  8. Set a new random WALLET_ENC_KEY of 32 or more characters while the old bot token is still set, restart, check the upgrade log, back up the keys offline, and only then rotate the bot token.
  9. Never set WALLET_ENC_KEY to the old bot token.

Keep your machine, Telegram account, bot token and .env file secure.

How is the pumpstriker.fun website secured?

  • Every page is served over HTTPS only, with HSTS.
  • The checkout is pinned to the official payment address and to the USDC and USDT mints on Solana, and it refuses anything else. Pay only there, and never pay an address that someone sends you in a message.
  • This website never links to, proxies or embeds your local dashboard or your bot.
  • We never ask for your keys: not on this site, in the support chat, by email or in the refund form. Never upload your .env file, wallets.json or your data folder. We never need your keys.
  • This website uses analytics, including Google Analytics and the Google Ads tag, subject to your choice in the cookie banner. The privacy policy explains what they collect.

How do I report a security problem?

Email bathyrdev@pumpstriker.fun. Describe what you found, where, and the steps to reproduce it. Our security.txt file lists the same contact.

  • In scope: the pumpstriker.fun website, its checkout and forms, and the PumpStriker software (the Engine and the Telegram bot).
  • Out of scope: services run by others, such as GMGN, Helius, Jupiter, pump.fun, Telegram and our hosting provider. Report those to their owners.
  • Never send a private key, seed phrase, .env file or wallets.json in a report. We never ask reporters for keys or payments.

How do I know I am dealing with the real PumpStriker?

The only website is pumpstriker.fun, and the only Telegram contact is @BathyrDEV. Bathyr Devs never asks for your private key or seed phrase; only your own bot's /import step, in your private chat, takes a key. There is no PumpStriker or BATHYR token, presale or airdrop, and we only take payment in the checkout on pumpstriker.fun.

The official channels page lists every confirmed channel and how to report a fake.

Frequently asked questions

Is PumpStriker safe to use?

PumpStriker is built so that control stays with you: wallet keys are stored encrypted only on your machine, every trade is signed there, and the bot answers only you. It cannot make memecoin trading safe. Memecoins are extremely high-risk, and you must secure your machine, Telegram account and bot token yourself.

Does Bathyr Devs ever see my private key?

No. The bot stores keys encrypted on your machine and never sends a key to Bathyr Devs. Bathyr Devs never asks for your private key or seed phrase; only your own bot's /import step, in your private chat, takes a key. That step passes the key through your Telegram chat once, and the bot deletes the message at once.

What happens if I do not set WALLET_ENC_KEY?

Your wallet keys are then encrypted under your Telegram bot token, which is one more reason to treat that token like a private key. Set your own random WALLET_ENC_KEY of 32 or more characters, and never set it to your old bot token.

Is the PumpStriker bot open source?

The bot's full source code comes with your download, under the MIT licence, so you can read it before you trust it with a wallet. It is provided as is, without warranty.

How do I report a security problem?

Email bathyrdev@pumpstriker.fun with what you found and how to reproduce it. Never include a private key, seed phrase, .env file or wallets.json. We never ask reporters for keys or payments.

Sources and review

  • Product facts: the current PumpStriker Engine and Telegram bot code (key storage, chat guards, the local link and pre-sign checks), checked in November 2026.
  • Telegram FAQ: two-step verification

Last reviewed by Mezyan D, Bathyr Devs. Facts are as of November 2026 and follow the current build; release notes are on the changelog.

Risks and disclosures

  • Self-custody: You run PumpStriker on your own computer or VPS and hold your own keys. Bathyr Devs never holds or moves your funds and never asks for your seed phrase; the software trades only from your own wallet, when you tap or within the auto-buy and exit rules you switch on. Importing a wallet means pasting its key into your private Telegram chat once (the bot deletes it at once), and Generate New shows a new key once in that chat, so use a dedicated trading wallet. On-chain transactions are final; we cannot reverse them or recover keys, so keep your machine, Telegram account, bot token and .env file secure.
  • As-is software: The open-source bot is provided as is under the MIT licence, without warranty. Read the code before you trust it with a wallet.
  • High risk: Memecoins are extremely high-risk and can move very fast in either direction. Only trade with money you can afford to put at risk.
  • No guarantees: PumpStriker does not promise profit, a win rate or any trading result. A signal or grade is information, not a prediction, and no tool can make an outcome certain. Anything promising guaranteed returns is a scam.
  • Third parties and partners: PumpStriker relies on services run by others (GMGN, Helius, Jupiter, pump.fun, Telegram), and their uptime, fees and terms apply. UnclaimedSol is a partner: rent-recovery claims made through the in-bot button may earn Bathyr Devs a referral share.
  • No token: There is no PumpStriker or BATHYR token, presale or airdrop. Anyone selling one is running a scam.

Not financial advice: PumpStriker is software, not financial advice. Nothing on this site is a recommendation to buy or sell any token. Do your own research (DYOR). Read the risk disclaimer and the terms of use.